Support-itecz opened a new pull request, #1361: URL: https://github.com/apache/arrow-java/pull/1361
## What's Changed `MessageSerializer.readMessage` reads the 4-byte little-endian length prefix and hands it straight to `ByteBuffer.allocate(messageLength)` without checking it. When a stream ends right after a continuation token (`0xFFFFFFFF`) `messageLength` is left at -1, and a malformed prefix can carry any other negative value. Both reach `ByteBuffer.allocate` with a negative argument and throw `IllegalArgumentException`, which escapes the `IOException` / end-of-stream contract that `ArrowStreamReader`, `ArrowFileReader` and `MessageChannelReader` rely on when reading untrusted input. Treat a continuation token with no following length as end-of-stream (return `null`, matching how a short first read is already handled) and reject a negative length with an `IOException` before the allocation. The guard sits in `readMessage` because every IPC reader funnels through it. AI assistance was used to prepare this change; I reviewed the diff and test results before submitting. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
